CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader

A buffer overflow vulnerability exists in Zlib::GzipReader . This vulnerability has been assigned the CVE identifier CVE-2026-27820 . We recommend upgrading the zlib gem. Details The zstream_buffer_ungets function prepends caller-provided bytes ahead of previously produced output but fails to guarantee the backing Ruby string has enough capacity before the memmove shifts the existing data. This can lead to memory corruption when the buffer length exceeds capacity. Recommended action We recommend to update the zlib gem to version 3.2.3 or later. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead: For Ruby 3.2 users: Update to zlib 3.0.1 For Ruby 3.3 users: Update to zlib 3.1.2 You can use gem update zlib to update it. If you are using bundler, please add gem "zlib", ">= 3.2.3" to your Gemfile. Affected versions zlib gem 3.2.2 or lower Credits Thanks to calysteon for reporting this issue. Also thanks to nobu for creating the patch. History Originally published at 2026-03-05 09:00:00 (UTC) Posted by hsbt on 5 Mar 2026

7 April 2026 at 07:29 am

1 views

CVE-2026-27820: Buffer overflow vulnerability in Zlib::GzipReader

A critical buffer overflow vulnerability in the Zlib::GzipReader library has been discovered and assigned the CVE identifier CVE-2026-27820. This issue affects versions of the zlib gem 3.2.2 and lower, making it imperative for users to upgrade to the recommended versions to mitigate the risk.

The vulnerability stems from a flaw in the zstream_buffer_ungets function within the Zlib::GzipReader. This function is responsible for prepending caller-provided bytes to previously produced output. However, it does not ensure that the backing Ruby string has sufficient capacity before shifting the existing data using memmove. When the buffer length exceeds the available capacity, this can lead to memory corruption, potentially allowing attackers to execute malicious code or manipulate data in unintended ways.

To address this vulnerability, the zlib gem has been updated to version 3.2.3 or later. For users of older Ruby series, specific versions are recommended to maintain compatibility: Ruby 3.2 users should update to zlib 3.0.1, while Ruby 3.3 users should upgrade to zlib 3.1.2. The simplest way to update the zlib gem is by running the command `gem update zlib` in the terminal. If you are using Bundler, add `gem "zlib", ">= 3.2.3"` to your Gemfile and run `bundle update zlib` to install the updated version.

The issue was reported by calysteon, who played a crucial role in bringing the vulnerability to light. nobu then developed a patch to fix the problem, ensuring that the zlib gem is secure against this buffer overflow attack.

It is essential for developers and system administrators to promptly update their systems to the recommended versions of the zlib gem. Failing to do so may leave applications and systems vulnerable to potential exploits, which could lead to data breaches, unauthorized access, or other security incidents.

In conclusion, the discovery and resolution of CVE-2026-27820 underscore the importance of regular software updates and vigilance in the open-source community. By addressing this vulnerability swiftly, the zlib gem has been fortified, and users can now enjoy enhanced security for their applications that rely on this library.

Source: Ruby News

Bloom Energy (BE) Surges 22.9% on CFO Appointment, Earnings Prep

Bloom Energy Corp. (NYSE:BE) is one of the 10 Stocks Powering Portfolios by Double Digits. Bloom Energy rallied by 22.9 percent week-on-week, as investors...

13 Apr

He Spent 8 Years Working Nights And Weekends Rehabbing Properties While Working Full Time. Now He's Facing A Separation And A $400K Tax Hit

A real estate investor who spent nearly a decade building a property portfolio from the ground up is now facing a painful dilemma: walk away from his...

13 Apr

Customs collections hit record high in Q1

The Bureau of Customs said it collected P239.05 billion in revenue in the three months of 2026, marking its highest first-quarter collection in history, fueled by a series of public auctions and stronger reforms.

7 Apr

UI backwards compatibility

About once a month, an app that I regularly use will change its UI in a way that breaks muscle memory, basically tricking the user into doing things they don’t want. Zulip In recent memory, Zulip (a slack competitor) changed its newline behavior so that ctrl + enter sends a message instead of inserting a new line. After this change, I sent a number of half-baked messages and it seemed like some other people did too. Around the time they made that change, they made another change such that a series of clicks that would cause you to send a private message to someone would instead cause you to send a private message to the alphabetically first person who was online. Most people didn’t notice that this was a change, but when I mentioned that this had happened to me a few times in the past couple weeks, multiple people immediately said that the exact same thing happened to them. Some people also mentioned that the behavior of navigation shortcut keys was changed in a way that could cause people to broadcast a message instead of sending a private message. In both cases, some people blamed themselves and didn’t know why they’d just started making mistakes that caused them to send messages to the wrong place. Doors A while back, I was at Black Seed Bagel, which has a door that looks 75% like a “push” door from both sides when it’s actually a push door from the outside and

7 Apr

Former Cathay cinema operator gets 4-month extension for debt moratorium

A previous plan to raise S$14 million via a placement of 1.9 billion shares had fallen through.

7 Apr

Press Start on April: GeForce NOW Brings 10 Games to the Cloud

No joke — GFN Thursday is skipping the tricks and heading straight into the games. April kicks off with ten new titles, bringing fresh adventures to GeForce NOW, including the launch of Capcom’s highly anticipated PRAGMATA. A dozen new games are available to stream this week, including Arknights: Endfield, which expands the acclaimed series into a full […]

7 Apr

A new way to express yourself: Gemini can now create music

The Gemini app now features our most advanced music generation model Lyria 3, empowering anyone to make 30-second tracks using text or images.

7 Apr

Gemini 3.1 Flash-Lite: Built for intelligence at scale

Gemini 3.1 Flash-Lite is our fastest and most cost-efficient Gemini 3 series model yet.

7 Apr

The Great Filter Comes For Us All

With a 13 billion year head start on evolution, why haven’t any other forms of life in the universe contacted us by now? ( Arrival is a fantastic movie. Watch it , but don’t stop there – read the Story of Your Life novella it was based on

7 Apr

Samsung's latest TV firmware update fixes the Chromecast issue for older models - finally

Samsung's 2026 TV lineup will feature built-in support for Google Cast, but with the latest firmware, models as far back as 2024 will also get an update.

7 Apr